svn commit: r363010 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Wed Jul  8 15:49:30 2020
New Revision: 363010
URL: https://svnweb.freebsd.org/changeset/base/363010

Log:
  Don't accept FORWARD-TSN chunks when I-FORWARD-TSN was negotiated
  and vice versa.
  
  MFC after:		1 week

Modified:
  head/sys/netinet/sctp_input.c

Modified: head/sys/netinet/sctp_input.c
==============================================================================
--- head/sys/netinet/sctp_input.c	Wed Jul  8 13:40:27 2020	(r363009)
+++ head/sys/netinet/sctp_input.c	Wed Jul  8 15:49:30 2020	(r363010)
@@ -5089,7 +5089,8 @@ process_control_chunks:
 			break;
 		case SCTP_FORWARD_CUM_TSN:
 		case SCTP_IFORWARD_CUM_TSN:
-			SCTPDBG(SCTP_DEBUG_INPUT3, "SCTP_FWD_TSN\n");
+			SCTPDBG(SCTP_DEBUG_INPUT3, "%s\n",
+			    ch->chunk_type == SCTP_FORWARD_CUM_TSN ? "FORWARD_TSN" : "I_FORWARD_TSN");
 			if (chk_length < sizeof(struct sctp_forward_tsn_chunk)) {
 				/* Its not ours */
 				*offset = length;
@@ -5101,6 +5102,18 @@ process_control_chunks:
 
 				if (stcb->asoc.prsctp_supported == 0) {
 					goto unknown_chunk;
+				}
+				if (((asoc->idata_supported == 1) && (ch->chunk_type == SCTP_FORWARD_CUM_TSN)) ||
+				    ((asoc->idata_supported == 0) && (ch->chunk_type == SCTP_IFORWARD_CUM_TSN))) {
+					if (ch->chunk_type == SCTP_FORWARD_CUM_TSN) {
+						SCTP_SNPRINTF(msg, sizeof(msg), "%s", "FORWARD-TSN chunk received when I-FORWARD-TSN was negotiated");
+					} else {
+						SCTP_SNPRINTF(msg, sizeof(msg), "%s", "I-FORWARD-TSN chunk received when FORWARD-TSN was negotiated");
+					}
+					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
+					sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
+					*offset = length;
+					return (NULL);
 				}
 				*fwd_tsn_seen = 1;
 				if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {